Device for controlling the operation of driving apparatus

ABSTRACT

A device for monitoring operation of a driving arrangement including at least a servo-mechanism, which includes a regulator, a driving motor controlled by the regulator, and an element which can be set in motion by the driving motor. A detection arrangement detects deviations between intended and actual movement positions of the element and an operation inhibiting and/or alarming arrangement inhibits operation of the driving arrangement and/or starts an alarm when impermissible deviations are detected. The monitoring device includes a redundant driving arrangement, which include at least one auxiliary servomechanism including a redundant regulator, a redundant driving motor controlled by the redundant regulator, and a redundant element which can be set in motion by the redundant driving motor. The regulator and the redundant regulator are connected to an arrangement delivering control information or imparting to the element and the redundant element the same movements or movements having a predetermined relation to each other. The detection arrangement is arranged to detect the deviations concerning the relative position or movements of the element or an object connected thereto, and the redundant element.

FIELD OF THE INVENTION

The present invention relates to a device for monitoring the operationof a driving arrangement according to the preamble of the subsequentclaim 1. As will be more closely described hereinbelow, it is preferredthat the driving arrangement forms part of a manipulator, in particularan industrial robot, so that the element which can be set in motion bythe driving motor forms a manipulator element of the manipulator.

PRIOR ART

The safety systems of the industrial robots of today are not sufficientfor allowing people to work within the operating range of an industrialrobot when the robot executes its programs. This is due to the fact thatthere is a large likelihood that an error in the electromechanics of therobot can cause robot movements that can injure or kill people in thevicinity of the arm system of the robot. The accidents, which can ensue,are due to the fact that the robot makes unexpected programmed movementsor that the robot rushes owing to measuring or driving system errors.The injuries which can ensue in that connection are either that therobot gives the person in the operating range a strong blow or injuriescaused by clamping. The cases when the head it subjected to theseinjuries are of course particularly serious.

Today it is presupposed that people are not allowed to be within theoperating range of industrial robots when the robots execute productionprograms at full speed, and therefore the safety systems are today onlyaimed at minimizing the damages to the robot, surrounding equipment andwork objects. Consequently, model based monitoring is used in order tocontinuously compare motor moments and motor position of the robot axleswith moments and positions of a model of the robot. A more simple typeof monitoring uses the control errors in the servos which arecontrolling the position and the velocity of the axles, and themagnitude of the moment references generated by the regulator or thecurrent controlling devices of the motors. Furthermore, the motorcurrents and the motor temperature are often monitored.

When the monitoring in the robot systems of today indicate an errorduring the axle manoeuvre, a digital output signal is generated from acomputer card to a relay, which is connected to a breaker, whichdisconnects the current to the motors of the robot and makes sure thatthe brakes of the robot are activated. The reason why these safetyconcepts are not sufficient is that many functions must worksimultaneously in order for the motors of the robot to, withsufficiently large likelihood, always become immediately currentless inconnection with a frightful situation. For instance, the software andhardware have to work in the processor which detects the condition oferror. Thereupon, the software and hardware for the processor whichsignals the condition of error to a digital safety output also have towork, as well as the relays and breakers which are to make sure that themotor currents disappear as soon as possible.

If the error is due to the fact that the computer, which is to indicatethe error, or the interface towards driving devices and measuringsystems of this computer is not working, there is the risk that theerror situation will not at all be detected and the driving system canmake the robot rush without any control. If the error is due to the factthat a person has been clamped up between the robot and the surroundingequipment of the robot, there is the risk that the monitoring withsubsequent software and hardware signalling and relay handling will takeso long time that too high clamping forces have time to develop beforethe motors are cut off. In the same way, there is a great risk that toostrong forces have time to develop between the robot and the person incase of a collision at the normal programmed robot velocity. Even thoughan advanced model-based collision detection is used, there is a riskthat the direction of the motors will reverse too late or that someerror in the software or hardware will make that the robot will not stopat all.

PURPOSE OF THE INVENTION

The purpose of the present invention is to achieve a monitoring device,by means of which a substantially improved safety in the monitoring isto be attained.

Preferably, it is intended that the risk of injuries when someone iswithin the range of the driving arrangement, in particular amanipulator, will be so small that it can be generally accepted to worktogether with a manipulator or an industrial robot.

BRIEF DESCRIPTION OF THE INVENTION

According to the present invention, a very safe monitoring device isachieved as a consequence of the redundant driving arrangement inaccordance with the subsequent characterizing part of claim 1, the highsafety being attained in that the detection arrangement is designed todetect the deviations concerning the relative positions or movementsbetween the driven element and the redundant element.

Manipulators or robots having this safety system will be able to worktogether with human beings, for instance during assemblage of differentwork shop technical products and disassembly of corresponding productsfor material recycling. With the inventional monitoring device,manipulators, in particular robots, can be introduced on differentplaces in an assembly line for motor cars without having to besurrounded by fences obstructing the motor car assemblers in theoperating range of the manipulators or robots. This opens up newpossibilities for automatization of the assembly of private cars,lorries and busses, which today is almost entirely manual. This gives agreat flexibility and the possibility to robotize afterwards an existingmanual assembly line.

Further features and embodiments of the inventional device are relatedto in the dependent claims.

BRIEF DESCRIPTION OF THE DRAWINGS

With reference to the subsequent drawings, a closer description ofembodiments of the invention given as examples will follow below.

In the drawings:

FIG. 1 is a schematic view illustrating a first embodiment of theinventional monitoring device,

FIG. 2 is an enlarged detail view illustrating a possible embodiment ofa safety contact,

FIG. 3 is a detail view illustrating an alternative embodiment of theinvention with non-contact measuring,

FIG. 4 is a detail view illustrating an embodiment of the detectionarrangement,

FIG. 5 is a detail view illustrating a brake arrangement for the drivenelement 6,

FIG. 6 is a detail view illustrating an alternative embodiment of thedriven auxiliary element and the detection arrangement,

FIG. 7 is a view illustrating an alternative detection arrangement basedon a belt transmission between the driven element and the auxiliaryelement,

FIG. 8 shows a further alternative of a detection arrangement comprisinga gear unit,

FIG. 9 is a detection arrangement illustrating that objects followingeach other can have very different designs,

FIG. 10 is a view illustrating a detection arrangement with seriesconnected contact points,

FIG. 11 is a view illustrating a detection arrangement with pneumaticrealization of contact points,

FIG. 12 is a view of a detection arrangement illustrating change ofcontact points during movement of the driven element and the redundantelement,

FIG. 13 is a view of a detection arrangement based on moire-techniquefor error detection,

FIG. 14 is a view of a detection arrangement comprising a linkage systemfor error detection, and

FIG. 15 is a view of a monitoring device, where the safety system isimplemented with simulated contact point.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

FIG. 1 shows a possible embodiment of the safety system embraced by thisinvention. The program executor 1 generates programmed path positions tothe path generator 2, which carries out interpolation between these pathpositions and generates references in the form of motor angles to beused by the servo of the control system. According to FIG. 1, the servofrequencies generated by the path generator 2 are sent to two separateservomechanisms 3 and 4, namely the regulators 3 a and 4 a,respectively, of the servomechanisms. The regulator 3 a is the one whichcontrols the motor 5 that is driving the associated element 6, whichhere is formed as a revolving robot arm, whereas the regulator 4 a is aredundant regulator controlling the redundant motor 7, which in thisembodiment is driving a redundant element 8, here an arm. The motor 5 iscontrolled by the regulators via the driving device 9, and are connectedto a three-phase voltage source 10 via the contactor 11. On the axle tothe motor 5, there is an angle sensor 12, which is measuring the motorangle for feedback to the regulator 3. Between the motor 5 and the arm 6there is a gear unit 13. The motor 7, which only needs to generate afraction of the moment generated by the motor 5, is driven by thedriving device 14, has the angle sensor 15 and the gear unit 16. The arm8 is in mechanical contact with an arm 17, which is mounted on the arm6. The contact between the arms 17 and 8 are obtained via two points 19and 20, where the point 20 is pressed against the point 19 by a spring21, which is located in a sleeve 22 of the arm 8.

During normal operation of the robot, the servomechanisms 3 and 4 willposition the points 19 and 20, respectively, in such a way that thesewill stand directly in front of each other and the breaker coil 18 willhold the breaker 11 drawn so that the motor 5 can operate. However, ifthe arm 17 is not moving in exactly the same way as the arm 8, thecontact between the points 19 and 20 will be broken and the breaker 11will immediately make the motor 5 currentless. In that connection, thereis relay logic (not shown in the figure), which entails that all themotors of the robot will become currentless, that the brakes will beactuated and that the robot will not restart without an operatorcontrolled restart.

With the safety system according to FIG. 1, all the errors in the servo3, driving device 9, motor 5, gear unit 13, supply voltage 10, measuringsensor 12, cabling, hardware and software will immediately result inthat the points 19 and 20 will be separated, which entails that thecurrent is disconnected from all the motors without any risk thathardware and software will fail to detect and signal the error viadigital outputs and relay connections to the breaker 11. The safetysystem also entails that the points 19 and 20 will be separated if themovement of the arm 6 is obstructed during its programmed movement,which results in that the robot motors immediately will be disengagedand will become currentless.

The only possibility of missing a condition of error would be if twoerrors occur simultaneously, one error in the servo 3 with associatedelectronics and one error in the servo 4 with associated electronics,and that these errors would make the points 19 and 20 move with the samevelocity in the same direction. The likelihood that two such errorsshould occur is non-existent, since the mass inertia of the real arm 6is much larger than the mass inertia of the redundant arm 8. Thisresults in that, in case of errors in the servo 3 as well as the servo4, the arm 8 will react with a shorter time constant than the arm 6 andthe points 19 and 20 will separate during the transient movements whichimmediately are obtained due to both errors.

In order to further reduce the forces which can develop at the collisionbetween robot and human being or when a human being is clamped betweenthe robot and its surroundings, the servo 3 can be model-controlled andtrimmed for low stiffness, which results in that external forces on thearm 6 rapidly cause angular misalignments of the arm and thereby thatthe points 19 and 20 will be separated. In order to further increase thesafety in this case, the weakness in the servo can be supplemented withor replaced by a mechanical weakness, e.g. in the form of a torsionspring, between the motor 5 and the arm 6.

Furthermore, it has to be pointed out that the robot should be designedfor a minimal movable arm mass and that the maximal angular velocity isfixed with regard to the maximal allowable collision forces at collisionrobot-human being. The maximal angular velocity is defined for the servo3 as well as the servo 4, whereby the risk of overspeed will benon-existent.

ALTERNATIVE EMBODIMENTS

The safety concept according to FIG. 1 can be implemented in severalways depending on the desired safety level, cost and adaption to robotconstruction. What can be varied is the detection principle fordeviation between the real arm 6 and the redundant arm 8, the design ofthe mechanics which connects the redundant arm 8 to the real arm 6, andthe location of the redundant arm 8 in the transmission from the motoraxle (of the motor 5) and the arm 6.

When it comes to the detection principle, two contact points accordingto FIG. 1 constitute one of the most simple and most direct methods fordetermining if the arm 6 and the redundant arm 8 are movingsynchronously. If only a mechanical contact is used between the real andthe redundant arm, there are then many possibilities to connect amovement of one or both of the points in FIG. 1 to a separateelectromechanical contact. An example of this is shown in FIG. 2, wherethe point 20 via the pin 24 is mechanically connected to a spring loadedcontact 23, which is connected to the coil 18 of the breaker 11. Thecontact 23 in FIG. 2 is in principle a binary position sensor, and sucha sensor can of course be implemented in many different ways, e.g. byuse of an electro-optical read fork, a capacitive sensor, an inductivesensor or an ultrasonic sensor. In those cases where the sensor is ofnon-contact type, this can of course be used directly for detectingdeviations between the real arm and the redundant arm. Consequently,FIG. 3 shows an example of how a non-contact sensor 25 can be used formeasuring the position of the redundant arm 8 in relation to theposition of the real arm 6.

The sensor 25 is measuring against a target 27 on the real arm 6, butthe sensor and the target can of course change places. From themeasuring transducer 26 a signal S is obtained, which signal depends onthe deviation between the arms 6 and 8. In the comparator 29 S iscompared with S_(ref)+ΔS and S_(ref)−ΔS and as long as the signal S iswithin the interval [S_(ref)−ΔS, S_(ref)+ΔS] the output of thecomparator is high and the driving circuit 30 gives a high signal, whichimplies that the coil 18 of the breaker 11 is holding the breakerclosed. However, if S leaves the allowed signal interval the motorcurrents are immediately broken and the brakes will be activated.However, there is now a risk that the sensor 25, measuring transducer 29or driving circuit 30 will receive such an error that the breaker 18will remain closed despite the arms 6 and 8 deviating in an angle inrelation to each other. In order to decrease this risk, a high-frequencytest signal s_(t) is introduced from the oscillator 28. This signal isadded to the position frequency of the servo 4 and entails that thesignal S is going to have a high-frequency component. The comparator 29and the driving circuit 30 are constructed in such a way that thehigh-frequency signal reaches the breaker circuit with the coil 18. Herethe high-frequency signal is detected by means of a phase-sensitivedemodulator 32, the output of which is supplied to a further comparator33, which is also connected to the coil 18. If any error will now occurin the servo 4, motor 7, sensor 15, driving circuit 14, sensor 25,measuring transducer 26, comparator 29 or driving circuit 30, the signalfiltered by the band pass filter 31 will immediately change and thecomparator 33 will make sure. that the breaker 11 will open and that themotors will become currentless.

As can be seen, the safety system with a sensor according to FIG. 3 willbe more complicated and also less safe than a system with a directelectrical contact member according to FIG. 1. The contact member inFIG. 1 has been accomplished as points 19 and 20, which is notnecessary. It is also possible to use e.g. a point against a conductiveelectrode surrounded by insulating areas according to FIG. 4.Furthermore, in FIG. 4 the possible risks that a breaker can get stuckin closed position have been eliminated by making the contacts in theredundant arm conduct the motor current directly, as well as the currentto the holding circuit 35 of the brake 36. Consequently, the threephases from the motor 5 pass three of the electrodes 19 and the points20 on the way to a common ground. The brake coil 35 is in the same wayconnected to ground and a total of four electrodes 19 is obtained in theinsulator 17 connected to the real arm and four points in the redundantarm 8, which is partly made of insulating material.

The electrodes 19 and the points 20 can of course change places andthere are many ways of connecting the contact pairs 19/20 in the motorcircuit. If strong brakes are provided, there is also the possibility ofactivating the brakes only with the redundant servo 7 and making themotor monitoring see that the motors are made currentless.

In FIG. 5 it is shown that it is also possible to activate the brakeswithout any electrical holding circuit being connected to contact pairsbetween the real and redundant arm. Instead, a completely mechanicalholding of the spring loaded brake disc 37 is used. This brake disc islocated in the brake mechanism 39, which holds the brake disc 37 and thepreloading spring 40. When the redundant arm 8 deviates from theposition of the real arm 6, the beam 20 in the yoke 19 will turn the arm17 around its attachment point 41, which is journalled in bearings, andthe brake disc 37 will be released and be pressed against brake blocks38, whereby the real arm is locked. The mechanical method for holdingthe brake can of course be carried out in many different ways andinstead of a brake some type of lever can be used, which is pushed intoa fixed mechanical stop when the redundant arm 8 deviates from the realarm 6.

In FIGS. 1, 3 and 5, the contact point 19, 20 and 25, 27 is positionedbetween the redundant and the real servo by means of arms 8 and 17. Thefunction of these arms can of course be carried out by other mechanicalsolutions. For instance, FIG. 6 shows a construction suitable of beingmounted on e.g. the wrist axles of a robot. The wrist mechanism is forthe axle in FIG. 5 carried out in such a way that the pipe 46 is turnedin relation to the pipe 45 when the corresponding motor is operating. Acarbon rod holder 47 with two spring-loaded carbon rods 44 is mounted onthe pipe 45, the carbon rods being connected to the relay coil 18 of themotor breaker. On the pipe 46 a ring is journalled in bearings. Thisring can be rotated around the pipe 46 by the redundant motor via thegear wheel 4. The motor 7 is mounted on the pipe 46. The ring 42 is madeof insulator material, at least on the surface against which the carbonrods 44 are pressed. On the electrically insulated surface of the ring42 there is a narrow electrically conducting rectangular surface, whichshort-circuits the carbon rods 44. When the axle 46 is turned inrelation to the axle 45, the redundant motor 7 will turn the ring in theopposite direction, so that the conducting surface 43 holds the rods 44short-circuited and thereby the motor breaker closed.

The redundant arm does not have to meet directly against the real arm,on the contrary, in constructions with lack of space, the movements ofthe real arm can be transferred to an extra axle via e.g. a belttransmission according to FIG. 7. Here the real arm 6 is turned by theaxle 45, on which a drum 52 for the belt 51 is fixed. The belt transfersthe turning of the axle 45 to the belt wheel 50, which is journalled inbearings in the housing 49. The belt wheel 50 is electricallyinsulating, at least on the surface facing the motor 7. On the insulatedsurface there is a small electrically conducting surface 43, which is incontact with the bearing housing 49. The redundant motor 7 has itscentre of rotation coinciding with the centre of rotation of the beltwheel 50, and the motor positions the contact wheel 48 by means of thearm 8 so that the contact wheel keeps electrical contact with theconducting surface 43. The breaker coil 18 will thereby receive itsholding current via motor bearings, motor axle, the redundant arm 8, thecontact wheel 48, the axle of the belt wheel and the bearing housing 49.

The contact point for current breaking to the coil 18 can be connectedto different components in the transmission between the motor 5 and thearms 6. For instance, the redundant motor 7 can turn the arm 8 inrelation to a contact point being directly turned by the motor 5. InFIG. 8 another variant is shown, where the redundant motor is integratedwith the gear unit. An extra gear wheel 53 is connected to the gearwheel 13 in the gear unit, which extra gear wheel turns a plate 54, onwhich contact points are provided. The redundant motor 7 turns the axle61, on which the redundant arm 8 is mounted. On the redundant arm 8there are two spring-loaded electrodes 56 and 57, which are connected tothe coil 58. A core 59 of iron or ferrite is magnetically connected tothe coil 58 via air gaps and the axle 61 made of magnetic material. Thecore 59 is provided with a coil 60, which functions as a primary coil tothe air gap transformer with the secondary coil 58. The primary coil 60is connected to the breaker coil 18 and controls the alternating currentdepending on whether the secondary coil is short-circuited or open.During normal operation, the secondary coil is short-circuited via themetal surface 55 on the plate 54, the remaining part of which isinsulating.

Besides the contact point carrying out circular motions, it is alsopossible to use a construction where the redundant arm carries outscanning motions in a predetermined pattern. An example of this is shownin FIG. 9. During rotation of the axle in question, the pipe 46 will inthe same way as in FIG. 6 move in relation to the pipe 45. On the pipe46 a collar 62, e.g. of metal, is rigidly mounted, which collar has asawblade-like profile. The redundant motor turns the redundant arm 8with the non-contact sensor 25 to and fro so that the sensor describes apath corresponding to the sawtooth pattern when the pipe 46 turns inrelation to the pipe 45. The higher the velocity of the pipes inrelation to each other, the higher frequency in turning the arm 8 to andfro is required by the motor 7. In case of a difference between theprogrammed movement of the real arm and the corresponding movement,converted into scanning, of the redundant arm 8, the sensor 24immediately detects an error and the motors are made currentlessaccording to the schedule in FIG. 3.

The described concept for high safety robot control can of course beimplemented in many different ways. A stepping motor can e.g. be usedfor the redundant motor, in which case the servo will be of anothertype. If a linear movement is to be monitored, the contact point has tobe moved with a translational movement, e.g. with means of a wormtransmission or a belt transmission. In order to obtain the samedynamics in the transfer function between the servo reference andmovement of the redundant arm and between servo reference and movementof the real axle, model-based variable filters can be used in theredundant servo. If it desired to increase the sensibility of themonitoring, e.g. at lower velocity, the redundant motor can becontrolled with a variable reference offset signal in position so thatthe redundant arm drives e.g. the point electrodes 56 and 57 in FIG. 8closer to the edge of the metal surface.

So far only 1 contact point has been used for each electrical circuit.However, several contact points can be used, either series of parallelconnected. By series connection of the contact points according to theexample in FIG. 10, the circuit breaking function of the contact pointswill be even safer. According to FIG. 10 the redundant motor 7 drivestwo redundant arms 8A and 8B via the axle 61. In the end of these arms,there is a conducting surface, 55A and 55B, respectively, against whichthe electrodes 56A and 56B are pressed. These electrodes are located onthe pipe 46, which is turned by the real motor. Between the conductingsurfaces 55A and 55B there is a conductor 64, which makes that currentsupply is obtained to the breaker coil 18 when the redundant arms 8A and8B move synchronously with the pipe 46. When an error occurs, theelectrodes 56A and 56B will get outside the surfaces 55A and 55B,respectively, where the redundant arms are electrically insulating.Through the slits 62A and 62B the redundant arms 8A and 8B will strikethe pipe 46 before the electrodes 55A and 55B get outside the insulatingsurface of the redundant arms around the conducting contact point.

Instead of using an electric circuit for manoeuvring breakers andbrakes, a pneumatic circuit can be used. In that case, with thearrangement in FIG. 10, the electrodes 56A and 56B and the conductingsurfaces 55A and 55B can be replaced by pneumatic pipe couplings 65A and65B and the conductor 64 by a tube or a pipe 66, see FIG. 11.

Of course, more than two contact points can also be used and it is alsopossible to change contact points when the real arm is moving, which isillustrated in FIG. 12. The pipe 46 is here seen in cross-section andthere is a number of contact surfaces 55 on the periphery thereof, whichcontact surfaces have an insulating surrounding in the form of aninsulating soft layer 67. The contact surfaces 55 are electricallyconnected to the breaker coil 18 via the conductors 68, 69 and 70. Tothe left of the pipe 46 there is a pipe 61, which is driven in rotationby the redundant motor (not shown). On the periphery of this pipe 61,there are a number of electrodes 56 with the same mutual distance as thedistance between the contact surfaces 55 on the pipe 46. All of theelectrodes 56 are electrically connected to the current supply of thebreaker coil by the conductors 71 and the conductor 72. When the pipes61 and 46 are synchronously driven in rotation, at least one electrode56 will always be in contact with a contact surface 55, so that thebreaker coil receives its current supply. If any error occurs, theelectrode 56 which is in contact position will slide out into theinsulating material 67 and the breaker will cut of the motor.

If a large number of contact points are used a moire-like technique isobtained. In FIG. 13 it is shown how this can be used. The real motorturns the axle 46, whereas the redundant motor turns the axle 61. Thedisc 73 with one of the moire-patterns is provided on the axle 61 andthe disc 74 with the other moire-pattern is provided on the axle 46. Thesimplest way to carry out moire-patterns is to let them be identical,which causes fade-out at a relative turning of half a pattern partition.For detection of the moire-pattern, one or several light sources 75 andone or several photodetectors 76 are used.

For the sake of completeness, it is shown in FIG. 14 that it is alsopossible to use a linkage system for obtaining contact points betweenthe real robot arm and the redundant arm. Consequently, FIG. 14 showshow the real robot axle 46 is connected with a linkage system to theredundant axle 61. The axle 46 drives a wheel 94 via the belt 96, whichwheel is journalled in bearings in the beam 93. The wheel 94 rotates tworods 89 and 90, which are mounted on each side of the wheel 94 andconnected to the linkage arms 85 and 86 via the hinges 91 and 92. In acorresponding way, the redundant axle 61 drives the linkage arms 83 and84 via the belt 78, the wheel 95, the rods 79 and 80 and the hinges 81and 82. The linkage arms 83 and 85 are coupled together by the bearings87A, which make that the two linkage arms can move longitudinally inrelation to each other. In the same way, the bearings 87B coupletogether the linkage arms 84 and 86. When the axles 46 and 61 arerotating synchronously, the distances between the bearings 81 and 91 and82 and 92, respectively, will be constant owing to that the length ofthe rod 79 is the same as the length of the rod 89, and the length ofthe rod 80 the same as the length of the rod 90. If a deviation fromsynchronism occurs, at least one of the distances mentioned above willhowever change, which results in that at least one of the contact points55A/56A and 55B/56B, respectively, will be broken. The angle between therods 89 and 90 has to be the same as the angle between 79 and 80, andpreferably in the vicinity of 90°, since this results in that at leastone of the linkages will have to change its length when the synchronismis lost.

Finally, the possibility of using a simulated contact point is shown inFIG. 15. The upper part of the figure is the same as in FIG. 1, butinstead of a physical contact point 19/20 between the real arm 6 and theredundant arm 8, a simulated contact point 97 is used. In this contactpoint 97 the position of the real arm is obtained from the angle sensor96, and the position of the redundant arm from a simulated redundant armwith associated motor and driving electronics in the module 98. In orderto obtain, in the normal case, the same transfer function between pathgenerator and real arm movement as between path generator and movementof simulated redundant arm, the simulated redundant arm module 98 isgiven essentially the same dynamic characteristics as the real arm. Theoutput signal from the contact point simulator 97 is supplied to anabsolute value function 99, the output of which is compared with thevalue ΔS in the comparator 100. ΔS simulates half the width of thecontact surface in the physical contact point. When the output from 99exceeds the value ΔS, the comparator will break the current supply tothe coil 18 via the driving circuit 101 and the motor 5 will be madecurrentless. In order to increase the safety in the system, the functiongenerator 102 generates a monitor signal, at one or several frequencies,with a repetitive wave form shape.

This signal is supplied to the input of the servo 3 via the summator 103and the input of the servo 4 via the subtractor 104. The frequency ofthe monitor signal can be varied so that it will not come at a frequencywhere the arm dynamics has a low transmission, e.g. at zero positionfrequencies. By supplying monitor signals to servo 3 and 4 withdifferent phase, the transmitted monitor signals on the input of thesubtractor 97 will have different phase, and a monitor signal component.will also be obtained on the output of the subtractor 97. The circuits99-101 are then constructed in such a way that they let through themonitor signal when they are working, and the monitor signal willfunction as a test signal for these circuits. On the output from thedriving circuit 101, the monitor signal is detected by thephase-sensitive detector 105, which generates an output signalproportional to the amplitude of the monitor signal on the output of thecircuit 101. The output signal from the detector 105 is supplied to acomparator 106, and if the level is higher than a threshold level t_(r)the driving circuit 107 will hold the relay 108 drawn. If, however, anerror occurs in the real system as well as the redundant system, or ifan error occurs in any of the circuits 97, 99, 100 or 101, the relay 108will be opened.

It is pointed out that all the electronic functions can be doubled ortrebled, the later in order to make decisions of the type 2 out of 3. Inorder to obtain the highest possible safety, different functions or thesame functions can be implemented in different hardwares, battery backupcan be used etc.

What is claimed is:
 1. A device for monitoring an operation of a drivingarrangement comprising at least one servo mechanism, which includes aregulator, a driving motor controlled by this regulator and an elementwhich can be set in motion by the driving motor, a detection arrangementfor detecting deviations between intended and actual movement positionsof the element and an operation inhibiting and/or alarming arrangementfor inhibiting the operation of the driving arrangement and/or startingan alarm when impermissible deviations have been established by thedetection arrangement, the device comprising a redundant drivingarrangement, which comprises at least one redundant servomechanism,including a redundant regulator, a redundant driving motor controlled bythis redundant regulator and a redundant element which can be set inmotion by this redundant driving motor, wherein the regulator and theredundant regulator are connected to an arrangement delivering controlinformation for imparting to the element and the redundant element samemovements or movements having a predetermined relation to each other,and that the detection arrangement is arranged to detect deviationsconcerning the relative position or movements of the element, or anobject connected thereto, and the redundant element.
 2. A deviceaccording to claim 1, wherein the detection arrangement comprisescontact members in contact with each other in a contact point, whichcontact members detect deviations between the element which can be setin motion by the driving motor and the redundant element.
 3. A deviceaccording to claim 2, wherein the detection arrangement compriseselectronic circuits or a computer for obtaining a contact point bycomparison between an output signal from an angle or position sensor,connected to the element to be monitored, and an output signal frommembers, comprised in the detection arrangement, being arranged to emitan output signal corresponding to a position of the redundant element.4. A device according to claim 3, wherein the output signal from thedetection arrangement represents a simulation of the redundant drivingmotor and the redundant element driven by said motor, which simulationhas been obtained by electronic circuits or one or several computers. 5.A device according to claim 3, wherein the simulation of the redundantdriving motor is dimensioned for obtaining same dynamic characteristicsas the driving motor with associated elements which can be set in motionby said motor.
 6. A device according to claim 3, wherein the detectionarrangement comprises detection members in a form of angle or positionsensors associated with the element and the redundant element,respectively, and a difference former connected to these sensors, and anoutput signal from this difference former is supplied to a comparator, acomparating signal of which simulates a half of a permitted relativemovement or position differential between the element and the redundantelement or objects connected to these.
 7. A device according to claim 6,further comprising a signal generator configured to generate a monitorsignal to the regulator in the servomechanism for the element and tosupply a monitor signal offset in phase to the regulator in theservomechanism for the simulated redundant element, and the detectionarrangement is arranged to use this monitor signal for securing that noerrors will ensue simultaneously as concerns driving of the element aswell as the simulated redundant element and that no errors will ensue inthe electronic circuits included in the difference former, thecomparator, and the detection arrangement.
 8. A device according toclaim 2, wherein the members being in contact with each other in thecontact point comprise electrically conducting members, one member ofwhich, directly or via transmissions, follows movements of the element,and a second member of which, directly or via transmissions, followsmovements of the redundant element.
 9. A device according to claim 8,wherein at least one of said electrically conducting members issurrounded by a medium, being insulating to electric current, in such away that a deviation in movements between the element and the redundantelement results in that that electrical contact in the contact point isinterrupted and that the driving motor is disengaged and/or is braked bythe operation inhibiting arrangement.
 10. A device according to claim 8,wherein one of the electrically conducting members comprises aconducting surface surrounded by an insulating surface, and two otherconducting members, connected in series, are pressed against theconducting surface so as to close an electric circuit, in which circuita breaker for the driving motor is included.
 11. A device according toclaim 8, wherein electrically conducting members in to or more contactpoints are connected in series.
 12. A device according to claim 2,wherein plural contact points are provided and an arrangement is suchthat a successive change of contact points takes place during relativemovements of the element and the redundant element.
 13. A deviceaccording to claim 2, wherein at least one contact point is located on alinkage system between the element and the redundant element.
 14. Adevice according to claim 2, wherein the contact point is mechanicallyconnected to an electric contact.
 15. A device according to claim 2,wherein the contact point is mechanically connected to a holdingmechanism for a brake or an electric breaker included in the operationinhibiting arrangement.
 16. A device according to claim 2, wherein saidcontact point is formed of a pneumatic coupling.
 17. A device accordingto claim 16, further comprising plural measuring points andmoirè-technique for measuring deviations between the movements of theelement and the redundant element.
 18. A device according to claim 2,wherein said contact point is formed between a sensor and a sensortarget and the detection arrangement comprises a non-contact measuringsystem.
 19. A device according to claim 18, wherein the measuring systemutilizes inductive, capacitive, optical, or ultrasonically basedsensors.
 20. A device according to claim 18, wherein the redundantdriving arrangement is arranged to make the redundant element oscillateor a sensor for the redundant element is arranged to be electricallymodulated at least one frequency, and the detection arrangement isarranged to use the signal/signals, thus obtained, as monitorsignal/signals for testing the monitoring device.
 21. A device accordingto claim 18, wherein the contact point is moveable and is defined by apattern arranged to move connected to the movements of either theelement or the redundant element.
 22. A device according to claim 21,wherein a sensor in the redundant element is arranged to be moved in apath corresponding to said pattern when the movements of the element andthe redundant element are synchronized.
 23. A device according to claim2, further comprising a signal generator configured to generate amonitor signal to the regulator in the servomechanism for the elementand to the regulator of the redundant servomechanism for the redundantelement, and that the monitor signal, transmitted in two ways, is usedfor monitoring if errors ensue simultaneously as concerns driving of theelement and the redundant element.
 24. A device according to claim 2,wherein the contact point is electromagnetically connected to drivingcircuits for the driving motor of the element and/or a brake for saidmotor.
 25. A device according to claim 1, wherein the drivingarrangement forms part of a manipulator of an industrial robot, and thatthe element which can be set in motion by the motor comprises an arm ofthe manipulator.